v0.2.8.4 — releases publish as prerelease until v0.3.0 (alpha)

.gitea/workflows/release.yml

@@ -478,10 +478,22 @@ jobs:
           VERSION=${GITHUB_REF#refs/tags/v}
           API="${GITHUB_SERVER_URL}/api/v1"
 
+          # Alpha until v0.3.0. Anything sorting below the stable floor publishes
+          # as a prerelease; this auto-flips to a stable release at v0.3.0 with no
+          # manual toggle to forget.
+          STABLE_FLOOR="0.3.0"
+          if [ "$(printf '%s\n%s\n' "$VERSION" "$STABLE_FLOOR" | sort -V | head -1)" = "$VERSION" ] \
+             && [ "$VERSION" != "$STABLE_FLOOR" ]; then
+            PRERELEASE=true
+          else
+            PRERELEASE=false
+          fi
+          echo "Release $VERSION prerelease=$PRERELEASE (stable floor v$STABLE_FLOOR)"
+
           RESPONSE=$(curl -sf -X POST "$API/repos/${GITHUB_REPOSITORY}/releases" \
             -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             -H "Content-Type: application/json" \
-            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"v$VERSION\",\"draft\":false,\"prerelease\":false}")
+            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"v$VERSION\",\"draft\":false,\"prerelease\":$PRERELEASE}")
           RELEASE_ID=$(echo "$RESPONSE" | grep -oP '"id":\s*\K[0-9]+' | head -1)
           if [ -z "$RELEASE_ID" ]; then
             echo "::error::failed to parse release id from API response: $RESPONSE"
@@ -512,13 +524,22 @@ jobs:
           VERSION=${GITHUB_REF#refs/tags/v}
           API="https://codeberg.org/api/v1/repos/Fimeg/RedFlag"
 
+          # Same alpha-until-v0.3.0 rule as the Gitea release above.
+          STABLE_FLOOR="0.3.0"
+          if [ "$(printf '%s\n%s\n' "$VERSION" "$STABLE_FLOOR" | sort -V | head -1)" = "$VERSION" ] \
+             && [ "$VERSION" != "$STABLE_FLOOR" ]; then
+            PRERELEASE=true
+          else
+            PRERELEASE=false
+          fi
+
           # Codeberg must have the tag before a release can target it.
           git push "https://Fimeg:${TOKEN}@codeberg.org/Fimeg/RedFlag.git" "refs/tags/v${VERSION}"
 
           RESPONSE=$(curl -sf -X POST "$API/releases" \
             -H "Authorization: token $TOKEN" \
             -H "Content-Type: application/json" \
-            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"v$VERSION\",\"draft\":false,\"prerelease\":false}")
+            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"v$VERSION\",\"draft\":false,\"prerelease\":$PRERELEASE}")
           RELEASE_ID=$(echo "$RESPONSE" | grep -oP '"id":\s*\K[0-9]+' | head -1)
           if [ -z "$RELEASE_ID" ]; then
             echo "::error::failed to parse codeberg release id from API response: $RESPONSE"

CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to RedFlag are documented here.
 
 Format: version, date, then grouped by category (Added, Changed, Removed, Fixed, Security).
 
+> **Status: alpha.** Every release before **v0.3.0** ships as a prerelease. Schema, APIs,
+> and config can still change without backward-compatibility shims (there are no live
+> field clients yet). **v0.3.0 is the planned first stable release.**
+
+---
+
+## v0.2.8.4 (June 2026)
+
+### Security
+- Supply chain: RedFlag now gates its own dependencies and ships the verdict signed —
+  self-attestation posture covering dep-scan, build provenance, and an install guard.
+- Crypto: forward-only key-path ceiling; the privileged helper compares artifact hashes
+  in constant time.
+- `/admin` route group latched behind `RequireAdmin` (SEC-026) — inert under the current
+  single-admin model, live the moment RBAC lands.
+
+### Added
+- Desktop tray updates route through the privileged helper like every other install path.
+
+### Changed
+- Web: interactive/brand surface recolored to steel blue, split cleanly from `danger` so
+  red reads as error again (the red scale is unchanged under `danger`).
+- Web: client errors log at the boundary (axios interceptor, ErrorBoundary, global
+  handlers) instead of through a toast-coupled wrapper.
+
+### Fixed
+- Web: 15 dashboard correctness/UX defects from the UI/UX audit — Docker filter cards that
+  matched nothing, duplicated retry/cancel hooks, WebSocket reconnect leaks, notification
+  dedup, and non-navigable notifications among them.
+- OSV resilience and capability-token serialization hardening.
+
 ---
 
 ## v0.2.8.2 (June 2026)

docker-compose.yml

@@ -21,7 +21,7 @@ services:
       context: .
       dockerfile: ./server/Dockerfile
       args:
-        BUILD_VERSION: ${BUILD_VERSION:-0.2.8.2}
+        BUILD_VERSION: ${BUILD_VERSION:-0.2.8.4}
     container_name: redflag-server
     volumes:
       - server-config:/app/config

server/internal/version/versions.go

@@ -15,8 +15,8 @@ import (
 // tag — the release gate enforces this. ldflags may override at build time;
 // the release pipeline injects the tag so binaries and source agree.
 var (
-	AgentVersion    = "0.2.8.2"
-	ConfigVersion   = "0.2.8.2"
+	AgentVersion    = "0.2.8.4"
+	ConfigVersion   = "0.2.8.4"
 	MinAgentVersion = "0.1.22"
 )